
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@deepracticex/template
Advanced tools
Template package demonstrating Deepractice package development standards
Deepractice Package Development Standards Template
This package serves as the standard template for all Deepractice packages. It demonstrates best practices for package structure, code organization, testing, and configuration.
# 1. Copy this template
cp -r packages/template packages/your-package
# 2. Update package.json
cd packages/your-package
# Edit: name, description, keywords
# 3. Install dependencies (from monorepo root)
pnpm install
# 4. Start development
pnpm dev
# 5. Run tests
pnpm test
All packages MUST follow the three-layer architecture:
src/
├── api/ # Public API - what users import
├── types/ # Type definitions - exported to users
└── core/ # Internal implementation - NOT exported
api/ - Public API Layer
Logger, createLogger(), convenience functionstypes/ - Type Definition Layer
LoggerConfig, LogLevelcore/ - Internal Implementation Layer
✅ Clear API Boundary - Users only see what they need
✅ Safe Refactoring - Change core/ without breaking users
✅ Better Testing - E2E test api/, unit test core/
✅ Type Safety - Types separated from implementation
packages/your-package/
├── src/
│ ├── api/ # Public API
│ │ ├── *.ts # Implementation files
│ │ └── index.ts # Unified exports
│ ├── types/ # Type definitions
│ │ ├── *.ts # Type files
│ │ └── index.ts # Unified exports
│ ├── core/ # Internal implementation
│ │ ├── *.ts # Internal files
│ │ └── index.ts # Internal exports
│ └── index.ts # Package entry point
│
├── features/ # BDD scenarios (Gherkin)
│ └── *.feature # Feature files
│
├── tests/
│ ├── e2e/
│ │ ├── steps/ # Cucumber step definitions
│ │ │ └── *.steps.ts
│ │ └── support/ # Test support files
│ │ ├── world.ts # Shared test context
│ │ └── hooks.ts # Setup/teardown
│ └── unit/ # Unit tests (optional)
│
├── dist/ # Build output (gitignored)
├── tsconfig.json # TypeScript configuration
├── tsup.config.ts # Build configuration
├── cucumber.cjs # Cucumber configuration
├── package.json # Package manifest
└── README.md # Package documentation
Two aliases for different contexts:
// ✅ src/ internal - use ~ alias
// src/api/example.ts
import type { ExampleConfig } from "~/types/config";
import { Processor } from "~/core/processor";
// ✅ tests/ access src/ - use @ alias
// tests/e2e/steps/example.steps.ts
import { createExample } from "@/index";
// tests/unit/core/processor.test.ts
import { Processor } from "@/core/processor";
// ❌ Wrong - relative paths
import { Example } from "../../../src/api/example";
Alias Convention:
~/* - Internal use within src/ (~ means "home/internal")@/* - External access from tests/ (@ means "external reference")Configuration:
tsconfig.json: baseUrl: "." + paths for both aliasestsup.config.ts: esbuildOptions.alias for build (only ~ needed)tsx: Native support for tsconfig pathsmoduleResolution: "Bundler" - no .js extension neededInterface-First Naming (NOT Hungarian notation):
// ✅ Correct - interface gets the clean name
export interface Logger {}
export class DefaultLogger implements Logger {}
export class PinoLogger implements Logger {}
// ❌ Wrong - Hungarian notation
export interface ILogger {}
export class Logger implements ILogger {}
Principles:
Logger)DefaultLogger, PinoLogger)I, T, EOne file, one type:
// example.ts - one class per file
export class Example {}
// config.ts - related types can group
export interface Config {}
export type ConfigOption = "a" | "b";
Index files for exports:
// api/index.ts - unified public API
export { Example, createExample } from "~/api/example";
export { Helper } from "~/api/helper";
// types/index.ts - unified types
export type { Config } from "~/types/config";
export type { Result } from "~/types/result";
Main src/index.ts:
// Export public API
export * from "~/api/index";
// Export types separately to avoid duplication
export type { Config, Result } from "~/types/index";
// Default export (optional)
import { createExample } from "~/api/example";
export default createExample();
DO NOT export core/ from package:
// ✅ Correct - only api and types
export * from "~/api/index";
export type * from "~/types/index";
// ❌ Wrong - exposing internal implementation
export * from "~/core/index"; // NEVER do this
Feature files (features/*.feature):
Feature: Example Functionality
As a developer
I want to use the Example API
So that I can process data
Rule: Example should process correctly
Scenario: Process simple input
Given I have created an Example instance
When I execute with input "hello"
Then the result should be "Processed: hello"
Step definitions (tests/e2e/steps/*.steps.ts):
import { Given, When, Then } from "@cucumber/cucumber";
import { expect } from "chai";
import { createExample } from "../../../src/index";
Given("I have created an Example instance", function () {
this.example = createExample();
});
When("I execute with input {string}", async function (input: string) {
this.result = await this.example.execute(input);
});
Then("the result should be {string}", function (expected: string) {
expect(this.result).to.equal(expected);
});
Test scripts:
{
"scripts": {
"test": "NODE_OPTIONS='--import tsx' cucumber-js",
"test:dev": "NODE_OPTIONS='--import tsx' cucumber-js --profile dev",
"test:ci": "NODE_OPTIONS='--import tsx' cucumber-js --profile ci"
}
}
Key points:
tsx instead of ts-node (native tsconfig paths support)NODE_OPTIONS='--import tsx'tsconfig.json:
{
"extends": "../typescript-config/base.json",
"compilerOptions": {
"outDir": "./dist",
"rootDir": "./src",
"types": [],
"baseUrl": "./src",
"paths": {
"~/*": ["./*"]
}
},
"include": ["src/**/*.ts"],
"exclude": ["node_modules", "dist"]
}
Key settings:
moduleResolution: "Bundler" (from base.json) - no .js extensionbaseUrl + paths for ~ aliastsup.config.ts:
import { defineConfig } from "tsup";
import path from "path";
export default defineConfig({
entry: ["src/index.ts"],
format: ["cjs", "esm"], // Dual format
dts: true, // Generate .d.ts
splitting: false,
sourcemap: true,
clean: true,
esbuildOptions(options) {
options.alias = {
"~": path.resolve(__dirname, "./src"),
};
},
});
Output:
dist/index.js - ESMdist/index.cjs - CommonJSdist/index.d.ts - TypeScript definitionspackage.json essentials:
{
"type": "module",
"main": "./dist/index.js",
"module": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js",
"require": "./dist/index.cjs"
}
},
"files": ["dist", "package.json", "README.md"]
}
Dependency Management:
package.jsonAvailable tools (auto-hoisted from root):
@deepracticex/* config packagesWhen creating a new package:
pnpm install from rootBuild the package:
pnpm build
Run tests:
pnpm test
Type check:
pnpm typecheck
Verify exports:
# Check dist/ contains expected files
ls -la dist/
Use Changesets for version management:
# 1. Create changeset
pnpm changeset
# 2. Version packages (CI will do this)
pnpm changeset version
# 3. Publish (CI will do this)
pnpm changeset publish
~ path alias for internal imports.js extensions in imports (with Bundler resolution)core/ if complex logicapi/api/index.tssrc/index.tsfeatures/tests/e2e/steps/types/*.tstypes/index.tssrc/index.ts as type-onlycore/ freelyapi/ interface stableThis template embodies Deepractice package development standards. If you have questions or suggestions for improvements, please discuss with the team.
Key Principle: Make it easy to do the right thing.
Last updated: 2025-10-08
FAQs
Template package demonstrating Deepractice package development standards
We found that @deepracticex/template demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.